Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,406 npm 223,265 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,406 reports · Feed

  • npm
    rlp.git all versions
    MAL-2026-11372 ghsa-malware
  • npm
    rlp-master all versions
    MAL-2026-11371 ghsa-malware
  • npm
    node-fs-extra-master all versions
    MAL-2026-11340 ghsa-malware
  • npm
    fsextrra all versions
    MAL-2026-11313 ghsa-malware
  • npm
    fs-extra-master all versions
    MAL-2026-11312 ghsa-malware
  • npm
    ethersss 6.15.0
    MAL-2026-11300 ghsa-malware, reversing-labs
  • npm
    ethers.json 6.15.0
    MAL-2026-11298 ghsa-malware, reversing-labs
  • npm
    ethers-io-ethers 6.15.0
    MAL-2026-11296 ghsa-malware, reversing-labs
  • npm
    ethe.json 6.15.0
    MAL-2026-11295 ghsa-malware, reversing-labs
  • npm
    ethers.jsonn 6.15.0
    MAL-2026-11299 ghsa-malware, reversing-labs
  • npm
    ethe 99.15.0
    MAL-2026-11294 ghsa-malware, reversing-labs
  • npm
    eth.json 6.15.0
    MAL-2026-11293 ghsa-malware, reversing-labs
  • npm
    thoughtgear all versions
    MAL-2026-11401 ghsa-malware
  • npm
    sunpro-3dmodel-renderer all versions
    MAL-2026-11389 ghsa-malware
  • npm
    shsk all versions
    MAL-2026-11379 ghsa-malware
  • npm
    shnc all versions
    MAL-2026-11378 ghsa-malware
  • npm
    rshell all versions
    MAL-2026-11374 ghsa-malware
  • npm
    rph-validator all versions
    MAL-2026-11373 ghsa-malware
  • npm
    qserver all versions
    MAL-2026-11362 ghsa-malware
  • npm
    payu-node all versions
    MAL-2026-11346 ghsa-malware
  • npm
    npum all versions
    MAL-2026-11342 ghsa-malware
  • npm
    n158 all versions
    MAL-2026-11335 ghsa-malware
  • npm
    inkalabs all versions
    MAL-2026-11321 ghsa-malware
  • npm
    ideascloud all versions
    MAL-2026-11318 ghsa-malware
  • npm
    host-inspector-module all versions
    MAL-2026-11317 ghsa-malware
  • npm
    files-bucket-server all versions
    MAL-2026-11311 ghsa-malware
  • npm
    express-wrapper all versions
    MAL-2026-11306 ghsa-malware
  • npm
    express-sequelize-wrapper all versions
    MAL-2026-11304 ghsa-malware
  • npm
    express-bubble all versions
    MAL-2026-11303 ghsa-malware
  • npm
    equiviewer all versions
    MAL-2026-11292 ghsa-malware
  • npm
    easyinstaller all versions
    MAL-2026-11286 ghsa-malware
  • npm
    dsilva-react-module-seed all versions
    MAL-2026-11283 ghsa-malware
  • npm
    api-gateway-lambda-router all versions
    MAL-2026-11237 ghsa-malware
  • npm
    android-web-logger all versions
    MAL-2026-11236 ghsa-malware
  • npm
    merg-descripters all versions
    MAL-2026-11331 ghsa-malware
  • npm
    express-test-dependency all versions
    MAL-2026-11305 ghsa-malware
  • npm
    @goodjavascript/dotenv 1.0.0
    MAL-2026-11212 ghsa-malware 3 IOCs
  • npm
    discord-starter all versions
    MAL-2026-11280 ghsa-malware
  • npm
    discord-ms all versions
    MAL-2026-11278 ghsa-malware
  • npm
    react-ag-grid all versions
    MAL-2026-11365 ghsa-malware